CoChat
Sign Up
Cited by 45Network Security and Intrusion DetectionInformation and Cyber SecurityDigital and Cyber Forensics

NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation

Open access
Li, Shaofei, Dong, Feng, Xiao, Xusheng, Wang, Haoyu, Shao, Fei, Chen, Jiedong, Guo, Yao, Chen, Xiangqun +1 more·2024·Proceedings 2024 Network and Distributed System Security Symposium
DOI 10.14722/ndss.2024.23204
Open this paper in CoChat — free account

Abstract

Advanced Persistent Threats (APT) attacks have plagued modern enterprises, causing significant financial losses.To counter these attacks, researchers propose techniques that capture the complex and stealthy scenarios of APT attacks by using provenance graphs to model system entities and their dependencies.Particularly, to accelerate attack detection and reduce financial losses, online provenance-based detection systems that detect and investigate APT attacks under the constraints of timeliness and limited resources are in dire need.Unfortunately, existing online systems usually sacrifice detection granularity to reduce computational complexity and produce provenance graphs with more than 100,000 nodes, posing challenges for security admins to interpret the detection results.In this paper, we design and implement NODLINK, the first online detection system that maintains high detection accuracy without sacrificing detection granularity.Our insight is that the APT attack detection process in online provenance-based detection systems can be modeled as a Steiner Tree Problem (STP), which has efficient online approximation algorithms that recover concise attack-related provenance graphs with a theoretically bounded error.To utilize the frameworks of the STP approximation algorithm for APT attack detection, we propose a novel design of in-memory cache, an efficient attack screening method, and a new STP approximation algorithm that is more efficient than the conventional one in APT attack detection while maintaining the same complexity.We evaluate NODLINK in a production environment.The openworld experiment shows that NODLINK outperforms two state-ofthe-art (SOTA) online provenance analysis systems by achieving magnitudes higher detection and investigation accuracy while having the same or higher throughput.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.14722/ndss.2024.23204

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • NODLINK formalized the detection objective and designed an approximation algorithm capable of generating theoretically error-bounded results in polynomial time, achieving fine-grained graph mining while maintaining high throughput, but its long-term APT detection capability remains to be verified.

    “NODLINK formalized the detection objective and designed an approximation algorithm capable of generating theoretically error-bounded results in polynomial time, achieving fine-grained graph mining while maintaining high throughput, but its long-term APT detection capability remains to be verified[9].”

    From From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps (2026) · cites this paper as [9]

    Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 89

  1. A. Alsaheel, Y. Nan, S. Ma, L. Yu, G. Walkup, Z. B. Celik, X. Zhang, and D. Xu, "ATLAS: A sequence-based learning approach for attack investigation," in Proceedings of the USENIX Security Symposium (USENIX Security), 2021, pp. 3005-3022.
  2. J. An and S. Cho, "Variational autoencoder based anomaly detection using reconstruction probability," Special Lecture on IE, vol. 2, no. 1, pp. 1-18, 2015.
  3. A. Bates, K. Butler, A. Haeberlen, M. Sherr, and W. Zhou, "Let SDN be your eyes: Secure forensics in data center networks," in Proceedings of the NDSS workshop on security of emerging network technologies (SENT), 2014, pp. 1-7.
  4. A. Bates, D. J. Tian, K. R. Butler, and T. Moyer, "Trustworthy Whole-System provenance for the linux kernel," in Proceedings of the USENIX Security Symposium (USENIX Security), 2015, pp. 319-334.
  5. Z. Bazrafshan, H. Hashemi, S. M. H. Fard, and A. Hamzeh, "A survey on heuristic malware detection techniques," in The 5th Conference on Information and Knowledge Technology, 2013, pp. 113-120.
  6. A. Borodin and R. El-Yaniv, Online computation and competitive analysis. Cambridge University Press, 2005.
  7. J. Byrka, F. Grandoni, T. Rothvoß, and L. Sanita, "An improved LP- based approximation for steiner tree," in Proceedings of the ACM Symposium on Theory of computing (STOC), 2010, pp. 583-592.
  8. F. Dong, S. Li, P. Jiang, D. Li, H. Wang, L. Huang, X. Xiao, J. Chen, X. Luo, Y. Guo, and X. Chen, "Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools," in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2023.
  9. F. Dong, L. Wang, X. Nie, F. Shao, H. Wang, D. Li, X. Luo, and X. Xiao, "DISTDET: A Cost-Effective distributed cyber threat detection system," in Proceedings of the USENIX Security Symposium (USENIX Security), 2023, pp. 6575-6592.
  10. M. Du, F. Li, G. Zheng, and V. Srikumar, "DeepLog: Anomaly detection and diagnosis from system logs through deep learning," in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2017, p. 1285-1298.
  11. D. Eppstein, "Finding the k shortest paths," in Proceedings 35th Annual Symposium on Foundations of Computer Science, 1994, pp. 154-165.
  12. P. Fang, P. Gao, C. Liu, E. Ayday, K. Jee, T. Wang, Y. F. Ye, Z. Liu, and X. Xiao, "Back-Propagating system dependency impact for attack investigation," in Proceedings of the USENIX Security Symposium (USENIX Security), 2022, pp. 2461-2478.
  13. P. Fei, Z. Li, Z. Wang, X. Yu, D. Li, and K. Jee, "SEAL: Storage- efficient causality analysis on enterprise logs with query-friendly compression," in Proceedings of the USENIX Security Symposium (USENIX Security), 2021, pp. 2987-3004.
  14. H. Feng, O. Kolesnikov, P. Fogla, W. Lee, and W. Gong, "Anomaly detection using call stack information," in Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), 2003, pp. 62-75.
  15. S. Forrest, S. Hofmeyr, A. Somayaji, and T. Longstaff, "A sense of self for Unix processes," in Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), 1996, pp. 120-128.
  16. P. Gao, X. Xiao, Z. Li, F. Xu, S. R. Kulkarni, and P. Mittal, "AIQL: Enabling efficient attack investigation from system monitoring data," in Proceedings of the USENIX Annual Technical Conference (USENIX ATC), 2018, pp. 113-126.
  17. M. R. Garey, R. L. Graham, and D. S. Johnson, "The complexity of computing steiner minimal trees," Society for Industrial and Applied Mathematics (SIAM) Journal on Applied Mathematics, vol. 32, no. 4, pp. 835-859, 1977.
  18. E. N. Gilbert and H. O. Pollak, "Steiner minimal trees," Society for Industrial and Applied Mathematics (SIAM) Journal on Applied Mathematics, vol. 16, no. 1, pp. 1-29, 1968.
  19. M. X. Goemans and D. P. Williamson, "A general approximation technique for constrained forest problems," Society for Industrial and Applied Mathematics (SIAM) Journal on Computing, vol. 24, no. 2, pp. 296-317, 1995.
  20. A. Gu, A. Gupta, and A. Kumar, "The power of deferral: Maintaining a constant-competitive steiner tree online," in Proceedings of the Annual ACM Symposium on Theory of Computing (STOC), 2013, p. 525-534.
  21. J. Gui, D. Li, Z. Chen, J. Rhee, X. Xiao, M. Zhang, K. Jee, Z. Li, and H. Chen, "APTrace: A responsive system for agile enterprise level causality analysis," in Proceedings of the International Conference on Data Engineering (ICDE), 2020, pp. 1701-1712.
  22. Z. Guo, D. Zhou, H. Lin, M. Yang, F. Long, C. Deng, C. Liu, and L. Zhou, "G2: A graph processing system for diagnosing distributed systems," in Proceedings of the USENIX Annual Technical Conference (USENIX ATC), 2011.
  23. X. Han, T. Pasquier, A. Bates, J. Mickens, and M. Seltzer, "Unicorn: Runtime provenance-based detector for advanced persistent threats," in Proceedings of the Network and Distributed System Security Sym- posium (NDSS), 2022.
  24. X. Han, X. Yu, T. Pasquier, D. Li, J. Rhee, J. Mickens, M. Seltzer, and H. Chen, "SIGL: Securing software installations through deep graph learning," in Proceedings of the USENIX Security Symposium (USENIX Security), 2021, pp. 2345-2362.
  25. W. U. Hassan, A. Bates, and D. Marino, "Tactical provenance analysis for endpoint detection and response systems," in Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), 2020, pp. 1172-1189.
  26. W. U. Hassan, S. Guo, D. Li, Z. Chen, K. Jee, Z. Li, and A. Bates, "Nodoze: Combatting threat alert fatigue with automated provenance triage," in Proceedings of the Network and Distributed System Security Symposium (NDSS), 2019.
  27. W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, D. Wang, Z. Chen, Z. Li, J. Rhee, J. Gui, and A. Bates, "This is why we can't cache nice things: Lightning-fast threat hunting using suspicion-based hierarchical storage," in Proceedings of the Annual Computer Security Applications Conference (ACSAC), 2020, p. 165-178.
  28. J. D. Herath, P. Yang, and G. Yan, "Real-Time evasion attacks against deep learning-based anomaly detection from distributed system logs," in Proceedings of the ACM Conference on Data and Application Security and Privacy (CODASPY), 2021, p. 29-40.
  29. J. E. Hopcroft, J. D. Ullman, and A. V. Aho, Data structures and algorithms. Addison-wesley Boston, MA, USA, 1983, vol. 175.
  30. M. N. Hossain, S. M. Milajerdi, J. Wang, B. Eshete, R. Gjomemo, R. Sekar, S. D. Stoller, and V. N. Venkatakrishnan, "SLEUTH: real-time attack scenario reconstruction from COTS audit data," in Proceedings of the USENIX Security Symposium (USENIX Security), 2017, pp. 487-504.
  31. M. N. Hossain, S. Sheikhi, and R. Sekar, "Combating dependence explosion in forensic analysis using alternative tag propagation seman- tics," in Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), 2020, pp. 1139-1155.
  32. M. N. Hossain, J. Wang, R. Sekar, and S. D. Stoller, "Dependence- Preserving data compaction for scalable forensic analysis," in Proceed- ings of the USENIX Security Symposium (USENIX Security), 2018, pp. 1723-1740.
  33. M. Hucka, "Nostril: A nonsense string evaluator written in Python," Journal of Open Source Software, vol. 3, no. 25, p. 596, 2018.
  34. F. K. Hwang and D. S. Richards, "Steiner tree problems," Networks, vol. 22, no. 1, pp. 55-89, 1992.
  35. N. Idika and A. P. Mathur, "A survey of malware detection techniques," Purdue University, vol. 48, no. 2, pp. 32-46, 2007.
  36. M. Imase and B. M. Waxman, "Dynamic steiner tree problem," Society for Industrial and Applied Mathematics (SIAM) Journal on Discrete Mathematics, vol. 4, pp. 369-384, 1991.
  37. M. Inam, Y. Chen, A. Goyal, J. Liu, J. Mink, N. Michael, S. Gaur, A. Bates, and W. U. Hassan, "SoK: History is a vast early warning system: Auditing the provenance of system intrusions," in Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), 2023, pp. 307-325.
  38. P. Jiang, R. Huang, D. Li, Y. Guo, X. Chen, J. Luan, Y. Ren, and X. Hu, "Auditing frameworks need resource isolation: A systematic study on the super producer threat to system auditing and its mitigation," in Proceedings of the USENIX Security Symposium (USENIX Security), 2023, pp. 355-372.
  39. P. Jiang, J. Xiao, D. Li, H. Yu, Y. Bai, Y. Guo, and X. Chen, "De- tecting malicious websites from the perspective of system provenance analysis," IEEE Transactions on Dependable and Secure Computing (TDSC), 2023.
  40. V. Karande, E. Bauman, Z. Lin, and L. Khan, "SGX-Log: Securing system logs with SGX," in Proceedings of the ACM on Asia Confer- ence on Computer and Communications Security (ASIA CCS), 2017, p. 19-30.
  41. R. M. Karp, Reducibility among combinatorial problems. Springer, 2010.
  42. K. Khan, S. U. Rehman, K. Aziz, S. Fong, and S. Sarasvady, "DB- SCAN: Past, present and future," in The fifth international conference on the applications of digital information and web technologies (ICADIWT 2014), 2014, pp. 232-238.
  43. S. T. King and P. M. Chen, "Backtracking intrusions," in Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles (SOSP), 2003, p. 223-236.
  44. D. P. Kingma and M. Welling, "Auto-Encoding Variational Bayes," in Proceedings of the International Conference on Learning Representa- tions, (ICLR), 2014.
  45. L. Kou, G. Markowsky, and L. Berman, "A fast algorithm for steiner trees," Acta informatica, vol. 15, pp. 141-145, 1981.
  46. K. H. Lee, X. Zhang, and D. Xu, "LogGC: Garbage collecting audit log," in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2013, p. 1005-1016.
  47. Z. Li, R. Yang, Q. A. Chen, and Y. Chen, "Poster: Mimic the whole attack chain: A first look at evasion against provenance graph based detection," in Proceedings of the Annual Computer Security Applications Conference (ACSAC), 2020.
  48. S. Lin, R. Clark, R. Birke, S. Schönborn, N. Trigoni, and S. Roberts, "Anomaly detection for time series using VAE-LSTM hybrid model," in ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2020, pp. 4322-4326.
  49. F. Liu, Y. Wen, D. Zhang, X. Jiang, X. Xing, and D. Meng, "Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise," in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2019, p. 1777-1794.
  50. X. Liu, C. Yang, D. Li, Y. Zhou, S. Li, J. Chen, and Z. Chen, "Adonis: Practical and efficient control flow recovery through os-level traces," ACM Transactions on Software Engineering and Methodology (TOSEM), 2023.
  51. Y. Liu, M. Zhang, D. Li, K. Jee, Z. Li, Z. Wu, J. Rhee, and P. Mittal, "Towards a timely causality analysis for enterprise security." in Pro- ceedings of the Network and Distributed System Security Symposium (NDSS), 2018.
  52. S. Ma, J. Zhai, Y. Kwon, K. H. Lee, X. Zhang, G. Ciocarlie, A. Gehani, V. Yegneswaran, D. Xu, and S. Jha, "Kernel-Supported Cost-Effective audit logging for causality tracking," in Proceedings of the USENIX Annual Technical Conference (USENIX ATC), 2018, pp. 241-254.
  53. E. Manzoor, S. M. Milajerdi, and L. Akoglu, "Fast memory-efficient anomaly detection in streaming heterogeneous graphs," in Proceed- ings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), 2016, p. 1035-1044.
  54. K. Mehlhorn, "A faster approximation algorithm for the steiner prob- lem in graphs," Information Processing Letters, vol. 27, no. 3, pp. 125-128, 1988.
  55. N. Michael, J. Mink, J. Liu, S. Gaur, W. U. Hassan, and A. Bates, "On the forensic validity of approximated audit logs," in Proceedings of the Annual Computer Security Applications Conference (ACSAC), 2020, pp. 189-202.
  56. S. M. Milajerdi, B. Eshete, R. Gjomemo, and V. Venkatakrishnan, "POIROT: Aligning attack behavior with kernel audit records for cyber threat hunting," in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2019, p. 1795-1812.
  57. S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V. Venkatakr- ishnan, "HOLMES: real-time APT detection through correlation of suspicious information flows," in Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), 2019, pp. 1137-1152.
  58. K.-K. Muniswamy-Reddy, U. Braun, D. A. Holland, P. Macko, D. Maclean, D. Margo, M. Seltzer, and R. Smogor, "Layering in provenance systems," in Proceedings of the USENIX Annual Technical Conference (USENIX ATC), 2009, p. 10.
  59. D. Mutz, F. Valeur, G. Vigna, and C. Kruegel, "Anomalous system call detection," ACM Trans. Inf. Syst. Secur., vol. 9, no. 1, p. 61-93, 2006.
  60. J. Naor, D. Panigrahi, and M. Singh, "Online node-weighted steiner tree and related problems," in 2011 IEEE 52nd Annual Symposium on Foundations of Computer Science, 2011, pp. 210-219.
  61. M. Niepert, M. Ahmed, and K. Kutzkov, "Learning convolutional neural networks for graphs," in Proceedings of the International Conference on Machine Learning (ICML), 2016, pp. 2014-2023.
  62. Z. Niu, K. Yu, and X. Wu, "LSTM-Based vae-gan for time-series anomaly detection," Sensors, vol. 20, no. 13, 2020.
  63. R. Paccagnella, K. Liao, D. Tian, and A. Bates, "Logging to the danger zone: Race condition attacks and defenses on system audit frameworks," in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2020, pp. 1551-1574.
  64. A. Papachristodoulou, C. Kyrkou, and T. Theocharides, "DriveG- uard: Robustification of automated driving systems with deep spatio- temporal convolutional autoencoder," in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV) Work- shops, 2021, pp. 107-116.
  65. J. Park, D. Nguyen, and R. Sandhu, "A provenance-based access control model," in Proceedings of the Annual International Conference on Privacy, Security and Trust (PST), 2012, pp. 137-144.
  66. G. Robins and A. Zelikovsky, "Tighter bounds for graph steiner tree approximation," Society for Industrial and Applied Mathematics (SIAM) Journal on Discrete Mathematics, vol. 19, no. 1, pp. 122-134, 2005.
  67. K. Satvat, R. Gjomemo, and V. Venkatakrishnan, "Extractor: Extract- ing attack behavior from threat reports," in Proceedings of the IEEE European Symposium on Security and Privacy (EuroS&P), 2021, pp. 598-615.
  68. R. Sekar, M. Bendre, D. Dhurjati, and P. Bollineni, "A fast automaton- based method for detecting anomalous program behaviors," in Pro- ceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), 2001, pp. 144-155.
  69. H. Takahashi, "An approximate solution for steiner problem in graphs," Math. Japonica, vol. 24, no. 6, pp. 573-577, 1980.
  70. Y. Tang, D. Li, Z. Li, M. Zhang, K. Jee, X. Xiao, Z. Wu, J. Rhee, F. Xu, and Q. Li, "NodeMerge: Template based efficient data reduction for big-data causality analysis," in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2018, p. 1324-1337.
  71. P. Veličković, W. Fedus, W. L. Hamilton, P. Liò, Y. Bengio, and R. D. Hjelm, "Deep graph infomax," in Proceedings of the International Conference on Learning Representations (ICLR), 2019.
  72. Q. Wang, W. U. Hassan, A. Bates, and C. A. Gunter, "Fear and logging in the internet of things," in Proceedings of the Network and Distributed System Security Symposium (NDSS), 2018.
  73. Q. Wang, W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, J. Rhee, Z. Chen, W. Cheng, C. A. Gunter et al., "You are what you do: Hunting stealthy malware via data provenance analysis." in Proceedings of the Network and Distributed System Security Symposium (NDSS), 2020.
  74. A. Wespi, M. Dacier, and H. Debar, "Intrusion detection using variable-length audit trail patterns," in Proceedings of the International Workshop on Recent Advances in Intrusion Detection (RAID), 2000, p. 110-129.
  75. A. Wespi, H. Debar, M. Dacier, and M. Nassehi, "Fixed-vs. variable- length patterns for detecting suspicious process behavior," J. Comput. Secur., vol. 8, no. 2,3, p. 159-181, 2000.
  76. J. Westbrook and D. C. K. Yan, "Greedy algorithms for the on- line steiner tree and generalized steiner problems," in Proceedings of the Workshop on Algorithms and Data Structures (WADS), 1993, p. 622-633.
  77. Y. Wu, A. Chen, A. Haeberlen, W. Zhou, and B. T. Loo, "Automated network repair with meta provenance," in Proceedings of the ACM Workshop on Hot Topics in Networks (HotNets), 2015, pp. 1-7.
  78. Y. Xie, D. Feng, Y. Hu, Y. Li, S. Sample, and D. Long, "Pagoda: A hybrid approach to enable efficient real-time provenance based intrusion detection in big data environments," IEEE Transactions on Dependable and Secure Computing (TDSC), vol. 17, no. 6, pp. 1283- 1296, 2020.
  79. Y. Xie, Y. Wu, D. Feng, and D. Long, "P-Gaussian: Provenance-Based gaussian distribution for detecting intrusion behavior variants using high efficient and real time memory databases," IEEE Transactions on Dependable and Secure Computing (TDSC), vol. 18, no. 6, pp. 2658-2674, 2021.
  80. C. Xu and B. Moseley, "Learning-Augmented algorithms for online steiner tree," in Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), vol. 36, no. 8, 2022, pp. 8744-8752.
  81. H. Xu, W. Chen, N. Zhao, Z. Li, J. Bu, Z. Li, Y. Liu, Y. Zhao, D. Pei, Y. Feng et al., "Unsupervised anomaly detection via variational auto- encoder for seasonal kpis in web applications," in Proceedings of the World Wide Web Conference (WWW), 2018, pp. 187-196.
  82. Z. Xu, Z. Wu, Z. Li, K. Jee, J. Rhee, X. Xiao, F. Xu, H. Wang, and G. Jiang, "High fidelity data reduction for big data security dependency analyses," in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2016, p. 504-516.
  83. D. Yang, B. Li, L. Rettig, and P. Cudré-Mauroux, "HistoSketch: Fast similarity-preserving sketching of streaming histograms with concept drift," in 2017 IEEE International Conference on Data Mining (ICDM), 2017, pp. 545-554.
  84. A. Z. Zelikovsky, "A faster approximation algorithm for the steiner tree problem in graphs," Information Processing Letters, vol. 46, no. 2, pp. 79-83, 1993.
  85. J. Zeng, Z. L. Chua, Y. Chen, K. Ji, Z. Liang, and J. Mao, "Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics," in Proceedings of the Network and Distributed System Security Symposium (NDSS), 2021.
  86. J. Zengy, X. Wang, J. Liu, Y. Chen, Z. Liang, T.-S. Chua, and Z. L. Chua, "ShadeWatcher: Recommendation-guided cyber threat analysis using system audit records," in Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), 2022, pp. 489-506.
  87. S.-s. Zhang, J.-w. Liu, X. Zuo, R.-k. Lu, and S.-m. Lian, "Online deep learning based on auto-encoder," Applied Intelligence, vol. 51, no. 8, pp. 5420-5439, 2021.
  88. Y. Zhang, Z. Lu, and S. Wang, "Unsupervised feature selection via transformed auto-encoder," Knowledge-Based Systems, vol. 215, p. 106748, 2021.
  89. Y. Zhou, X. Liang, W. Zhang, L. Zhang, and X. Song, "VAE-based deep svdd for anomaly detection," Neurocomputing, vol. 453, pp. 131- 140, 2021.

Cited by

Sorted by citations

Authors
Li, S., Dong, F., Xiao, X., Wang, H., Shao, F., Chen, J., Guo, Y., Chen, X., & Li, D.
Affiliations
  • Peking University (CN)
  • Huazhong University of Science and Technology (CN)
  • Arizona State University (US)
ORCID
Venue
Proceedings 2024 Network and Distributed System Security Symposium
Publisher
Internet Society
Published
2024
DOI
10.14722/ndss.2024.23204
OpenAlex
W4388481469
Cited by
45
References
1
Citations by year
2026: 18 · 2025: 24 · 2024: 3
FWCI
19.65
Type
conference paper
Language
en
Open access
Locations
  • Network and Distributed System Security Symposium (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • National Science Foundation (2028748)
  • National Natural Science Foundation of China (62172009, 62072046)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
Keywords
advanced persistent threats, provenance graphs, Steiner tree problem, approximation algorithms, in-memory cache, enterprise security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review